opendatahub-io/notebooks#1595: chore: pin micropipenv and uv versions in Dockerfile pip install commands for reproducible builds
#1998
Conversation
…ckerfile `pip install` commands for reproducible builds
WalkthroughAll modified Dockerfiles and the Dockerfile fragment generator now pin Python tooling installs to exact versions: micropipenv[toml]==1.9.0 and uv==0.8.12. Multiple files previously installing unpinned micropipenv[toml] and uv were changed. No other instructions, control flow, or public APIs were altered. Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes Possibly related issues
Possibly related PRs
Suggested labels
Suggested reviewers
Tip 🔌 Remote MCP (Model Context Protocol) integration is now available!Pro plan users can now connect to remote MCP servers from the Integrations page. Connect with popular remote MCPs such as Notion and Linear to add more context to your reviews and chats. ✨ Finishing Touches
🧪 Generate unit tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. CodeRabbit Commands (Invoked using PR/Issue comments)Type Other keywords and placeholders
Status, Documentation and Community
|
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here.
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
github-actions
bot
added
the
review-requested
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 5
🧹 Nitpick comments (26)
runtimes/datascience/ubi9-python-3.12/Dockerfile.cpu (1)
23-23: ✓ Pinning Verified: micropipenv 1.9.0 & uv 0.8.12All Python 3.12 Dockerfiles (including this one at
runtimes/datascience/ubi9-python-3.12/Dockerfile.cpu:23) pin both packages correctly, and both versions exist on PyPI. Repo-wide ripgrep confirms no unpinned installs in the 3.12 images.Optional: centralize these version values to simplify future bumps:
ARG MICROPIPENV_VERSION=1.9.0 ARG UV_VERSION=0.8.12 RUN pip install --no-cache-dir -U \ "micropipenv[toml]==${MICROPIPENV_VERSION}" \ "uv==${UV_VERSION}"runtimes/rocm-tensorflow/ubi9-python-3.12/Dockerfile.rocm (1)
23-23: Pinning looks good; consistent with the PR’s objective.Exact pins for micropipenv and uv support reproducibility. Given prior analysis that micropipenv is unused in our 3.12 images, consider removing it in the dedicated cleanup (issue #1685) rather than here.
If you want easier future bumps, you can introduce build args and reuse them:
- RUN pip install --no-cache-dir -U "micropipenv[toml]==1.9.0" "uv==0.8.12" + ARG MICROPIPENV_VERSION=1.9.0 + ARG UV_VERSION=0.8.12 + RUN pip install --no-cache-dir -U "micropipenv[toml]==${MICROPIPENV_VERSION}" "uv==${UV_VERSION}"runtimes/tensorflow/ubi9-python-3.11/Dockerfile.cuda (1)
23-23: Good pinning; aligns with 3.11 policy to keep micropipenv present.This keeps builds reproducible and respects the “don’t remove micropipenv from 3.11 images” policy.
Prefer invoking pip via the interpreter for robustness in multi-Python environments:
- RUN pip install --no-cache-dir -U "micropipenv[toml]==1.9.0" "uv==0.8.12" + RUN python -m pip install --no-cache-dir -U "micropipenv[toml]==1.9.0" "uv==0.8.12"codeserver/ubi9-python-3.12/Dockerfile.cpu (1)
23-23: Pinning is correct and consistent.This ensures the uv CLI used later is the intended version, improving determinism across rebuilds.
Use the interpreter to call pip:
- RUN pip install --no-cache-dir -U "micropipenv[toml]==1.9.0" "uv==0.8.12" + RUN python -m pip install --no-cache-dir -U "micropipenv[toml]==1.9.0" "uv==0.8.12"jupyter/rocm/pytorch/ubi9-python-3.11/Dockerfile.rocm (1)
36-36: LGTM on pinning; reproducibility improved.Matches the PR intent and 3.11 retention policy for micropipenv.
Slight robustness improvement:
- RUN pip install --no-cache-dir -U "micropipenv[toml]==1.9.0" "uv==0.8.12" + RUN python -m pip install --no-cache-dir -U "micropipenv[toml]==1.9.0" "uv==0.8.12"runtimes/tensorflow/ubi9-python-3.12/Dockerfile.cuda (2)
23-23: Prefer invoking pip via the interpreter for robustnessUsing python -m pip avoids PATH/symlink surprises if multiple interpreters are present.
Apply this diff:
-RUN pip install --no-cache-dir -U "micropipenv[toml]==1.9.0" "uv==0.8.12" +RUN python -m pip install --no-cache-dir -U "micropipenv[toml]==1.9.0" "uv==0.8.12"
23-23: Note: micropipenv is unused in 3.12 images — cleanup tracked separatelyThis pin is fine for now. As discussed and tracked in issue #1685, micropipenv installations in Python 3.12 images are not used and can be removed later to reduce image size. No action required in this PR.
codeserver/ubi9-python-3.11/Dockerfile.cpu (1)
23-23: Minor: use python -m pip to bind pip to the correct interpreterSafer invocation pattern within container images.
Apply this diff:
-RUN pip install --no-cache-dir -U "micropipenv[toml)==1.9.0" "uv==0.8.12" +RUN python -m pip install --no-cache-dir -U "micropipenv[toml]==1.9.0" "uv==0.8.12"jupyter/minimal/ubi9-python-3.12/Dockerfile.cuda (2)
23-23: Nit: prefer python -m pip over pipImproves robustness against PATH ambiguities.
Apply this diff:
-RUN pip install --no-cache-dir -U "micropipenv[toml]==1.9.0" "uv==0.8.12" +RUN python -m pip install --no-cache-dir -U "micropipenv[toml]==1.9.0" "uv==0.8.12"
23-23: Future cleanup: micropipenv not used on 3.12 imagesThis PR is scoped to pinning only, which is fine. Just noting that removal for 3.12 images is already tracked in issue #1685 to trim image size.
runtimes/pytorch/ubi9-python-3.12/Dockerfile.cuda (2)
23-23: Use python -m pip for consistency with the active interpreterMinor robustness improvement.
Apply this diff:
-RUN pip install --no-cache-dir -U "micropipenv[toml]==1.9.0" "uv==0.8.12" +RUN python -m pip install --no-cache-dir -U "micropipenv[toml]==1.9.0" "uv==0.8.12"
23-23: Heads-up: micropipenv appears unused on 3.12 imagesNo change requested here; just noting the planned cleanup tracked in #1685 to reduce footprint.
runtimes/minimal/ubi9-python-3.11/Dockerfile.cpu (1)
30-30: Nit: prefer python -m pipBind pip to the right interpreter explicitly.
Apply this diff:
-RUN pip install --no-cache-dir -U "micropipenv[toml]==1.9.0" "uv==0.8.12" +RUN python -m pip install --no-cache-dir -U "micropipenv[toml]==1.9.0" "uv==0.8.12"rstudio/c9s-python-3.11/Dockerfile.cuda (1)
9-9: Optional: centralize tool versions via ARGs for easier bumpsConsider defining MICROPIPENV_VERSION and UV_VERSION as build args near the top and referencing them in the RUN line. This keeps Dockerfiles consistent with scripts/dockerfile_fragments.py and simplifies version bumps across many files.
Example change in this file:
+ARG MICROPIPENV_VERSION=1.9.0 +ARG UV_VERSION=0.8.12 - RUN pip install --no-cache-dir -U "micropipenv[toml]==1.9.0" "uv==0.8.12" + RUN pip install --no-cache-dir -U "micropipenv[toml]==${MICROPIPENV_VERSION}" "uv==${UV_VERSION}"runtimes/rocm-pytorch/ubi9-python-3.12/Dockerfile.rocm (1)
23-23: Note: micropipenv may be removable from 3.12 images in future (tracked separately)Per prior analysis, many 3.12 images install micropipenv without using it. Not a blocker here, but consider following up under the existing cleanup effort to avoid unnecessary footprint.
If helpful, I can prepare a scoped follow-up PR that removes unused micropipenv from 3.12 images while keeping 3.11 images intact per policy.
jupyter/datascience/ubi9-python-3.11/Dockerfile.cpu (1)
36-36: Nit: prefer invoking pip via the interpreterUsing python -m pip avoids PATH/alias ambiguities and is more robust across environments.
Apply this diff:
-RUN pip install --no-cache-dir -U "micropipenv[toml]==1.9.0" "uv==0.8.12" +RUN python -m pip install --no-cache-dir -U "micropipenv[toml]==1.9.0" "uv==0.8.12"jupyter/rocm/pytorch/ubi9-python-3.12/Dockerfile.rocm (1)
36-36: FYI: Follow-up cleanup for 3.12 images (tracked elsewhere)This keeps installing micropipenv on Python 3.12 images. As noted in the ongoing cleanup effort (issue #1685), micropipenv is unused on 3.12 and could be removed in a separate PR. No change requested here.
scripts/dockerfile_fragments.py (2)
31-31: Extract versions to module-level constants and use python -m pipCentralizing the versions makes future bumps trivial and reduces drift; invoking pip via the interpreter is more robust.
Apply this diff to the changed line:
- textwrap.dedent('''RUN pip install --no-cache-dir -U "micropipenv[toml]==1.9.0" "uv==0.8.12"'''), + textwrap.dedent(f'''RUN python -m pip install --no-cache-dir -U "micropipenv[toml]=={MICROPIPENV_VERSION}" "uv=={UV_VERSION}"'''),Add these near the top of the file (outside the changed range):
# Centralized tool versions for reproducible builds MICROPIPENV_VERSION = "1.9.0" UV_VERSION = "0.8.12"
31-31: Add a CI check for pinned micropipenv and uv versionsWe ran the verification script across all Dockerfiles and confirmed that every
RUN pip install … micropipenv[toml]==1.9.0anduv==0.8.12is already pinned correctly. To guard against future version drift, integrate the following check as a CI step (for example, in.github/workflows/validate-dockerfiles.yml):#!/usr/bin/env bash set -euo pipefail MICRO="1.9.0" UV="0.8.12" missing=0 # Iterate over all Dockerfiles fd -a '^Dockerfile.*$' | while read -r f; do # micropipenv pin check grep -En 'pip install.*micropipenv' "$f" | while IFS=: read -r lno line; do if ! grep -q "micropipenv\[toml\]==${MICRO}" <<< "$line"; then echo "$f:$lno: ERROR — micropipenv not pinned to ${MICRO}: $line" missing=1 fi done # uv pin check grep -En 'pip install.*\buv\b' "$f" | while IFS=: read -r lno line; do if ! grep -q "uv==${UV}" <<< "$line"; then echo "$f:$lno: ERROR — uv not pinned to ${UV}: $line" missing=1 fi done done if [ "$missing" -ne 0 ]; then echo "❌ Dockerfile version pin verification failed." exit 1 fi echo "✅ All Dockerfiles correctly pin micropipenv[toml]==${MICRO} and uv==${UV}."• Place this script in your repo (e.g.
scripts/verify-docker-pins.sh)
• Add a CI job that runs it on every PR to catch any unpinned changes earlyrstudio/c9s-python-3.11/Dockerfile.cpu (1)
9-9: Nit: prefer python -m pipMore resilient invocation pattern in containerized environments.
Apply this diff:
-RUN pip install --no-cache-dir -U "micropipenv[toml]==1.9.0" "uv==0.8.12" +RUN python -m pip install --no-cache-dir -U "micropipenv[toml]==1.9.0" "uv==0.8.12"jupyter/trustyai/ubi9-python-3.11/Dockerfile.cpu (1)
36-36: Nit: use python -m pipPrefer interpreter-qualified pip to avoid PATH ambiguity.
Apply this diff:
-RUN pip install --no-cache-dir -U "micropipenv[toml]==1.9.0" "uv==0.8.12" +RUN python -m pip install --no-cache-dir -U "micropipenv[toml]==1.9.0" "uv==0.8.12"jupyter/datascience/ubi9-python-3.12/Dockerfile.cpu (1)
36-36: Note: micropipenv in Python 3.12 images is slated for removal (tracked separately)Pinning is fine here for reproducibility. As a separate cleanup (already tracked in issue #1685), Python 3.12 images plan to drop micropipenv entirely; this PR need not change scope.
jupyter/tensorflow/ubi9-python-3.12/Dockerfile.cuda (1)
36-36: Minor note: 3.12 images still include micropipenvThis PR rightly focuses on version pinning. Cleanup for removing micropipenv from 3.12 images is a separate effort already tracked (no action needed here).
rstudio/rhel9-python-3.11/Dockerfile.cpu (1)
9-10: Optional: consider centralizing versions via build args or fragments for easier updates.Not blocking this PR, but defining MICROPIPENV_VERSION and UV_VERSION as ARGs (or ensuring scripts/dockerfile_fragments.py owns these constants) would reduce future churn across many Dockerfiles.
Example:
ARG MICROPIPENV_VERSION=1.9.0 ARG UV_VERSION=0.8.12 RUN pip install --no-cache-dir -U "micropipenv[toml]==${MICROPIPENV_VERSION}" "uv==${UV_VERSION}"runtimes/minimal/ubi9-python-3.12/Dockerfile.cpu (1)
30-31: FYI: micropipenv presence in 3.12 images is slated for cleanup (issue #1685).No action required in this PR, but note that 3.12 images reportedly don't use micropipenv. This pin keeps builds reproducible until that cleanup lands.
runtimes/pytorch+llmcompressor/ubi9-python-3.11/Dockerfile.cuda (1)
159-161: Remove redundant micropipenv reinstall here; keep only uv.Once the earlier micropipenv install is pinned, this later block can install only uv to avoid redundant reinstalls and save build time.
Apply this diff to the current block:
-RUN pip install --no-cache-dir -U "micropipenv[toml]==1.9.0" "uv==0.8.12" +RUN pip install --no-cache-dir -U "uv==0.8.12"
|
/lgtm |
|
@jiridanek: The following tests failed, say
Full PR test history. Your PR dashboard. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
Description
How Has This Been Tested?
Merge criteria:
Summary by CodeRabbit